# Create Integration Token

Create an adhoc integration token restricted to a single integration. The token used to call
this API must have the necessary permissions to create tokens and have access to the account
and integration IDs. Permissions may not be escalated, so any operation that the invocation
token does not have access to cannot be granted.

Operation ID: tokens_create_integration_token

Endpoint: POST /v1/tokens/{accountId}/{integrationId}
Security: BearerAuth

## Path parameters:

  - `accountId` (string, required)

  - `integrationId` (string, required)

## Request fields (application/json):

  - `name` (string,null)
    Unique name token. If not provided, defaults to generated newly created refresh token id.

  - `token_ttl` (string,null)
    Token time-to-live. If not provided, defaults to 10 minutes. Use the format "1h", "1m", "1s" for hours, minutes, and seconds respectively, e.g., "2h" for 2 hours.

## Response 200 fields (application/json):

  - `result` (object, required)

  - `result.secret` (string, required)
    Secret value for the token; used for authentication when making requests.

  - `result.expires` (string, required)
    Time when this token expires and can no longer be used again.

  - `result.permissions` (object, required)

  - `result.permissions.resource_id` (string, required)

  - `result.permissions.resource_type` (string, required)
    Type of the resource that this permission grants access to. Must be one of the following: "organization, "integration"

  - `result.permissions.parent_id` (string, required)

  - `result.permissions.id` (string, required)

  - `result.permissions.organization_id` (string, required)

  - `result.permissions.member_id` (string, required)

  - `result.permissions.role_binding` (array,null)
    Roles granted to this token.

  - `result.permissions.adhoc_role` (object)

  - `result.permissions.adhoc_role.resources` (object, required)

  - `result.permissions.adhoc_role.resources.organizations` (object)

  - `result.permissions.adhoc_role.resources.organizations.ids` (array, required)
    List of organization ids that this role definition grants access to. Use "\*" to grant access to all organization ids.

  - `result.permissions.adhoc_role.resources.organizations.labels` (array,null)
    List of organization labels this role definition grants access to.

  - `result.permissions.adhoc_role.resources.accounts` (object)

  - `result.permissions.adhoc_role.resources.accounts.ids` (array, required)
    List of account ids that this role definition grants access to. Use "\*" to grant access to all account ids.

  - `result.permissions.adhoc_role.resources.accounts.labels` (array,null)
    List of account labels this role definition grants access to. If both labels and environments are specified both must pass

  - `result.permissions.adhoc_role.resources.accounts.environments` (array,null)
    Account environments this role definition grants access to. If both labels and environments are specified both must pass
    Enum: "test", "prod"

  - `result.permissions.adhoc_role.resources.integrations` (object)

  - `result.permissions.adhoc_role.resources.integrations.categories` (array, required)
    List of categories ids that this role definition grants access to. Use "\*" to grant access to all category ids.
    Enum: "appsec", "assets", "chat", "cloudsecurity", "custom", "edr", "emailsecurity", "endpointmanagement", "identity", "incidentresponse", "notifications", "siem", "sink", "storage", "ticketing", "vulnerabilities"

  - `result.permissions.adhoc_role.permission_set` (string, required)
    Enum: "administrator", "viewer", "member", "account-manager", "connect-ui", "token-issuer", "mcp-integrations-use-only", "mcp-management"

  - `result.permissions.root_organization_id` (string)

  - `result.claims` (object,null)
    Additional claims added to the token.

## Response 400 fields (application/json):

  - `occurred_at` (string, required)
    The date and time the problem occurred.

  - `status` (integer, required)
    The HTTP status code of the problem. Matches the HTTP response code sent by the server.

  - `instance` (string, required)
    A URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.

  - `message` (string, required)
    A short, display-friendly summary of the problem.

  - `type` (string)
    A URI reference that identifies the type of problem that occurred. When the URI scheme is HTTP(s), it may or may not be possible to deference the URL to a display-friendly description of the problem type.

  - `cause` (array,null)
    A list of the root cause(s) for this problem occurrence. Includes at minimum one root cause, and is otherwise an unordered list of causes.

  - `cause.type` (string, required)
    A URI reference that identifies the type of problem that occurred. When the URI scheme is HTTP(s), it may or may not be possible to deference the URL to a display-friendly description of the problem type.

  - `cause.message` (string, required)
    A short, display-friendly summary of the problem.

  - `cause.detail` (string,null)
    A display-friendly and more detailed explanation of the problem. It may offer additional contextual detail, but may also be just a generic description of the problem.

  - `cause.remediation` (string,null)
    A display-friendly explanation for how to remediate the problem. This field may be omitted in case there are multiple problems, each with its own remediation, or if no remediation is possible.

  - `cause.context` (object)

  - `cause.context.parameter` (object)

  - `cause.context.parameter.id` (string, required)
    If the location of the parameter is body, this value is always a JSON Pointer, otherwise it's the name of the parameter.

  - `cause.context.parameter.location` (string, required)
    Enum: "header", "path", "query", "body"

  - `cause.context.parameter.value` (any,null)
    The given value of the parameter.

  - `cause.context.resources` (array,null)

  - `cause.context.resources.type` (string, required)
    Enum: "account", "bridge", "credential", "integration_point", "integration", "member", "operation", "organization_webhook", "role", "sub_org", "token", "transform"

  - `cause.context.resources.id` (string, required)
    ID of the related resource.

  - `cause.context.resources.rel` (string, required)
    Enum: "affected", "cause"

  - `cause.context.raw_error` (string,null)
    If available this represents the underlying raw error, for example an error response from a Provider.

  - `cause.context.provider_details` (object,null)
    If available this represents the underlying details from the provider. May include the error message, status code, and other details.

  - `detail` (string,null)
    A display-friendly and more detailed explanation of the problem. It may offer additional contextual detail, but may also be just a generic description of the problem.

  - `remediation` (string,null)
    A display-friendly explanation for how to remediate the problem. This field may be omitted in case there are multiple problems, each with its own remediation, or if no remediation is possible.

  - `context` (object)